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Foreword 

This Technical Specification (TS) has been produced by the 3 rd Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version xy.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections updates 
etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 

This Technical Specification has been produced by the 3GPP TSG SA to allow for the standardisation in the area of 
lawful interception of telecommunications. This document describes in general the architecture and functions for lawful 
interception. Laws of individual nations and regional institutions (e.g. European Union), and sometimes licensing and 
operating conditions define a need to intercept telecommunications traffic and related information in modern 
telecommunications systems. It has to be noted that lawful interception shall always be done in accordance with the 
applicable national or regional laws and technical regulations. 
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1 Scope 

The present document describes the architecture and functional requirements within a Third Generation Mobile 
Communication System (3GMS). 

The specification shows the service requirements from a Law Enforcement point of view only The aim of this 
document is to define a 3GMS interception system that supports a number of regional interception regulations but these 
regulations are not repeated here as they vary. Regional interception requirements shall be met in using specific 
(regional) mediation functions allowing only required information to be transported. 

2 References — — 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. ^ 

• References are either specific (identified by date of publication, edition number, version number etc ) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

H 1 ETR 331: "Definition of User Requirements for Lawful Interception of Telecommunications 

Requirements of the Law Enforcement Agencies". 

P] ES 201 1 58: "Lawful Interception; Requirements for network functions". 

[3] ES 201 671 : "Handover Interface for the lawful interception of telecommunications traffic". 

t 4 l GSM 01 .33: "Lawful Interception requirements for GSM". 

[5] GSM 02.33: "Lawful Interception - stage 1 ". 

[6] GSM 03.33: "Lawful Interception - stage 2". 

I 7 ] 3G TS 33. 1 06: "3GPP Lawful Interception Requirements". 

[8] J-STD-25: "Interim Standard, Lawfully Authorised Electronic Surveillance" . 

t 9 l 3GPP Ts 23.003: "3rd Generation Partnership Project; Technical Specification Group Core 

Network; Numbering, addressing and identification (Release 1 999)" . 

[10] 3GPP TS 23.060: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; General Packet Radio Service (GPRS); Service description- Staee 2 
(Release 1999)". ' ^ 
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3 Definitions, symbols and abbreviations 



3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply. 

Network Based Interception: Interception that is invoked at a network access point regardless of Target Identity. 

Subject Based Interception: Interception that is invoked using a specific Target Identity 

Target Identity: A technical identity that uniquely identifies a target of interception. One target may have one or 
several identities. 

Interception Area: is a subset of the network service area comprised of a set of cells which defines a geographical 
zone. o & r 

Location Dependent Interception: is interception of a target mobile within a network service area that is restricted to 
one or several Interception Areas (IA). 



3.2 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

3GMS 3rd Generation Mobile Communication System 

3G GGSN 3rd Generation Gateway GPRS Support Node 

3G GSN 3rd Generation GPRS Support Node (GGSN/SGSN) 

3G MSC 3rd Generation Mobile Switching Center 

3G SGSN . 3rd Generation Serving GPRS Support Node 

3G UMSC 3rd Generation Unified Mobile Switching Centre 

ADMF Administration Function 

CC Content of Communication 

DF Delivery Function 

ECT Explicit Call Transfer 

GPRS General Packet Radio Service 

HI Handover Interface 

IA Interception Area 

IP Internet Protocol 

IRI Intercept Related Information 

LDI Location Dependent Interception 

LEA Law Enforcement Agency 

LEMF Law Enforcement Monitoring Facility 

RA Routing Area 

SAI Service Area Identity 



4 Functional architecture 



The following picture contains the reference configuration for the lawful interception. The various entities and 
interfaces are described in more detail in the succeeding subclauses. 
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Figure 1: Reference configuration 

The reference configuration is only a logical representation of the entities involved in lawful interception and does not 
mandate separate physical entities. This allows for higher levels of integration. 

Regional Mediation Functions, which may be transparent or part of the administration and delivery functions are used 
to convert information on the HI1 , HI2 and HI3 interfaces in the format described in various national or regional 
specifications. For example, if ES 201 671 or J-STD-25 is used, then the adaptation to Ml , HI2 and ffl3 will be as 
defined in those specifications. 

There is one Administration Function (ADMF) in the network. Together with the delivery functions it is used to hide 
from the 3G MSC and 3G GSN that there might be multiple activations by different Law Enforcement Agencies 
(LEAs) on the same target. The administration function may be partitioned to ensure separation of the provisioning data 
from different agencies. 

The HI2 and HI3-interfaces represent the interfaces between the LEA and two delivery functions. The delivery 
functions are used: 

- to distribute the Intercept Related Information (IRI) to the relevant LEA(s) via HI2 (based on IAs, if defined); 

- to distribute the Content of Communication (CC) to the relevant LEA(s) via HI3 (based on IAs, if defined). 
See the remaining sections of this document for definitions of the XI J, Xl_2, Xl_3, X2 and X3 interfaces. 
Interception at the Gateways is a national option. 
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5 



Activation, deactivation and interrogation 



Figure 2 is an extraction from the reference intercept configuration shown in figure 1 which is relevant for activation, 
deactivation and interrogation of the lawful interception. 



Figure 2: Functional model for Lawful Interception activation, deactivation and interrogation 

In addition to the typical 3G MSC and 3G GSN functional entities, a new functional entity is introduced - the ADMF - 
the Lawful Interception administration function. The ADMF: 



- keeps the intercept activities of individual LEAs separate; 

- interfaces to the intercepting network. 

Every physical 3G MSC and 3G GSN is linked by an own Xl_l-interface to the ADMF. Consequently, every single 3G 
MSC and 3G GSN performs interception (activation, deactivation, interrogation as well as invocation) independently 
from other 3G MSCs and 3G GSNs. The HI 1 -interface represents the interface between the requester of the lawful 
interception and the Lawful administration function; it is included for completeness, but is beyond the scope of 
standardisation in mis document. 

The target identities for 3GMS interception can be at least on of the following: IMSI, MSISDN or IMEI. 
In case of location dependent interception the following network/national options exist: 

- target location versus Interception Areas (IAs) check in the 3G MSC , 3G SGSN, and Delivery Functions (DFs); 

- target location versus IAs check in the DFs (physical collocation of the DFs to the 3G MSC and 3G SGN may be 
required by national law). 

NOTE 1 : The IA is previously defined by a set of cells. From the location of the target this set of cells permits to 
find the relevant IA. 

NOTE 2: It is not required that the 3G GMSC or the 3G GGSN are used for interception when Location Dependent 
Interception is mvoked and the location of the target is not available. 




- interfaces with all the LEAs that may require interception in the intercepting network; 



5.1 



Activation 



Figures 3,4 and 5 show the information flow for the activation of Lawful Interception. 
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5.1.1 X1_1 -interface 

The messages sent from the ADMF to the 3G MSC and 3G GSN (Xl_l -interface) contain the: 

- target identities (MSISDN, IMSI or IMEI) (see note 4); 

- information whether the Content of Communication (CC) shall be provided (see note 1 ); 

- information whether the Intercept Related Information (IRI) shall be provided (see note 1 ); 

- address of Delivery Function 2 (DF2) for the intercept related information (see note 2); 

- address of Delivery Function 3 (DF3) for the intercepted content of communications (see note 3); 

- IA in case of location dependent interception. 

NOTE 1 : As an option, the filtering whether intercept product and/or intercept related information has to be 

provided can be part of the delivery functions. If the option is used, the corresponding information can be 
omitted on the Xl_l -interface, while "information not present" means "intercept product and related 
information has to be provided" for the SN. Furthermore the delivery function which is not requested has 
to be "pseudo-activated", in order to prevent error cases at invocation. 

NOTE 2: As an option, only a single DF2 is used by and known to every 3G MSC and 3G GSN. In this case the 
address of DF2 can be omitted. 

NOTE 3: As an option, only a single DF3 is used by and known to every 3G MSC and 3G GSN. In this case the 
address of DF3 can be omitted. 

NOTE 4: Since the IMEI is not available, interception of IMEI is not applicable at the 3G Gateway. 

If after activation subsequently Content of Communications (CC) or Intercept Related Information (IRI) has to be 
activated (or deactivated) an "activation change request" with the same identity of the target is to be sent. 



ADMF 



request for lawful 
interception activation 



response for lawful 
interception activation 



3G MSC, 
3G GSN 



. activation of delivery 
functions ... 



lawful interception 
activation 



lawful interception 
activation ack 



Figure 3: Information flow on X1_1 -interface for Lawful Interception activation 

Interception of a target can be activated on request from different LEAs and each LEA may request interception via a 
different identity. In this case, each target identity on which to intercept will need to be sent via separate activation 
messages from ADMF to the 3G MSC and 3G GSN on the XI J -interface. Each activation can be for CC onlv IRI 
only, or both CC and IRI. 

When several LEAs request activation on the same identity then the ADMF determines that there are existing 
activations on the identity. In this case, the ADMF will not send an additional activation message to the 3G MSC and 
3G GSN except when the activation needs to change from CC only or IRI only to CC and IRI. In that case an activation 
change message will be sent to the 3G MSC and 3G GSN. 
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5.1.2 X1_2-interface (IRI) 

For the activation of IRI the message sent from the ADMF to the DF contains: 

- the target identity; 

- the address for delivery of IRI (= LEMF address); 

- which subset of information shall be delivered; 

- a DF2 activation identity, which uniquely identifies the activation for DF2 and is used for further interrogation 
deactivation, respectively; 

- the IA in case of location dependent interception; 

- the warrant reference number if required by national option. 

If a target is intercepted for several LEAs and/or several identities simultaneously, a single activation of delivery is 
necessary for each combination of LEA and identity . 



or 



ADMF 



DF 2 



request for lawful 
interception activation 



response for lawful 
interception activation 



lawful interception 
activation 



lawful interception 
activation ack 



activation on X1M | 
Figure 4: Information flow on X1_2-interface for Lawful Interception activation 

5.1.3 X1 ^interface (CC) 

For the activation of intercepted Content of Communications the message sent from the ADMF to the Delivery 
Function contains: 

- the target identity; 

- the address of delivery for CC (= LEMF address); 

- a DF3 activation identity, which uniquely identifies the activation for DF3 and is used for further interrogation 
deactivation, respectively; fc 

- the IA in case of location dependent interception; 

- the warrant reference number if required by national option. 

If a target is intercepted by several LEAs and/or several identities simultaneously, a single activation of delivery is 
necessary for each combination of LEA and identity. 



or 
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request for lawful 
interception activation 



response for lawful 
interception activation 
< 




lawful interception 
activation 



lawful interception 
activation ack 



. activation on X11..., 



Figure 5: Information flow on X1_3-interface for Lawful Interception activation 

5.2 Deactivation 

Figures 6,7 and 8 show the information flow for the deactivation of the Lawful interception. 

5.2.1 X1_1 -interface 

The messages sent from the ADMF to the 3G MSC and 3G GSN for deactivation contain: 

- the target identity; 

- the possible relevant IAs in case of location dependent interception. 



ADMF 



request for lawful 
interception deactivation 



3G MSC 
3G GSN 



lawful interception 
deactivation 



lawful interception 
deactivation ack 



response for lawful 
interception deactivation 



Figure 6: Information flow on X1_1 -interface for Lawful Interception deactivation 




If interception of a target has been activated via different identities then a 
sent from the ADMF to the 3G MSC and 3G GSN for each identity. 



separate deactivation message will need to be 



When several LEAs requested activation on the same identity and subsequently request deactivation then the ADMF 
determines that there are remaining activations on the identity. In this case, the ADMF will not send a deactivation 
message to the 3G MSC and 3G GSN except when the activation needs to change from CC and IRI to CC only or IRI 
only. In that case an activation change message will be sent to the 3G MSC and 3G GSN. 
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5.2.2 X1_2-interface (IRI) 

The messages sent from the ADMF to Delivery Function 2 for the deactivation of the Intercept Related Information 
contain: 

- a DF2 activation id, which uniquely identifies the activation to be deactivated for DF2. 

If a target is intercepted by several LEAs and/or several identities simultaneously, a single deactivation is necessary for 
each combination of LEA and identity. 



ADMF 



DF2 



request for lawful 
interception deactivation 




deactivation on XT 1 




lawful interception 
deactivation 

— h 




response for lawful 
interception deactivation 

<4 — 


lawful interception 
deactivation ack 

M 


■<s. 




... deactivation on XtM 









Figure 7: Information flow on X1_2-interface for Lawful Interception deactivation 

5.2.3 X1_3-interface (CC) 

For the deactivating the delivery of the CC the messages from the ADMF to DF3 contain: 
- a DF3 activation id, which uniquely identifies the activation to be deactivated for DF3. 



ADMF 



request for lawful 

interception deactivation 





DF3 



response for lawful 
interception deactivation 




lawful interception 
deactivation 



lawful interception 
deactivation ack 



Figure 8: Information flow on X1_3-interface for Lawful Interception deactivation 

5.3 Interrogation 

Interrogation provides the current status of the interception activation in the system. Interrogation of all activations for a 
given LEA is an ADMF function. 
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5.3.1 Interrogation of the 3G MSC and 3G GSN 

Figure 9 shows the information flow for the interrogation of the Lawful Interception. It shall be possible to interrogate 

- a specific activation at each relevant 3G MSC and 3G GSN;. 

- all activations at each relevant 3G MSC and 3G GSN. 

As result of the interrogation the activation status and data are returned. 



ADMF 



request for lawful 
interception interrogation 



3G MSC 
3G GSN 



lawful interception 
interrogation 



lawful interception 
interrogation ack 




response for lawful 
interception interrogation 



Figure 9: Interrogation of the Lawful Interception (3G MSC and 3G GSN) 

5.3.2 Interrogation of Delivery Functions 

Figure 10 shows the information flow for the interrogation of the Lawful Interception. It shall be possible to interrogate: 

- a specific activation at a DF; 

- all activations at a DF for a given target identity; 

- all activations at a DF. 

As result of the interrogation the activation status and data are returned. 



ADMF 



request for lawful 
interception interrogation 



response for lawful 
interception interrogation 

<«■ — 



lawful interception 
interrogation 



DF2/DF3 



lawful interception 
interrogation ack 




Figure 10: Interrogation of the Lawful Interception (Delivery Functions) 
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6 Invocation of Lawful Interception for Circuit Switched 
Services 

Figure 1 1 shows an extraction from the reference configuration in figure 1 which is relevant for the invocation of the 
lawful interception. 



HI2 



LEMF 



X2 



Delivery 
Function 2 



Delivery 
Function 3 



3G MSC 



HI3 X3 
Figure 11: Functional model for Lawful Interception invocation 

The HI2 and HI3 interfaces represent the interfaces between the LEMF and two delivery functions. Both interfaces are 
subject to national requirements. They are included for completeness, but are beyond the scope of standardization in this 
document. The delivery functions are used: 

- to convert the information on the X2-interface to the corresponding information on the HI2-interface; 

- to convert the information on the X3-interface to the corresponding information on the HI3-interface; 

- to distribute the intercept related information to the relevant LEA(s) (based on IAs, if defined); 

- to distribute the intercept product to the relevant LEA(s) (based on IAs, if defined). 

In case a call is selected based on several identities (MSISDN, IMSI, IMEI) of the same target, the 3G MSC will deliver 
CC and IRI only once to the DF2 and DF3. DF2 and DF3 will then distribute the information to the relevant LEA that 
requested interception on a particular target identity. 

For the delivery of the CC and IRI, the 3G MSC provides a correlation number and target identity to the DF2 and DF3 
which is used there in order to select the different LEAs to which the product shall be delivered. 

NOTE: If interception has been activated for both parties of the call both CC and IRI will be delivered for each 
party as separate intercept activity. 

For Location Dependent Interception, the location dependency check occurs at the establishment of each call 
Subsequent dependency checks for simultaneous calls are not required, but can be a national option. 

If a target is marked using an IA in the 3G MSC, the 3G MSC shall perform a location dependency check at call set-up 
Only if the target's location matches the IA is call the intercepted. 

If a target is marked using an IA in the DF2, the DF2 shall perform a location dependency check at reception of the first 
IRI for the call. Only if the target's location matches the IA for certain LEAs is IRI the relayed to these LEAs All 
subsequent IRIs for the call are sent to the same LEAs. * 

If a target is marked using an IA in the DF3, the DF3 shall perform a location dependency check at reception of the CC 
Only if the target's location matches the IA for certain LEAs is the CC relayed to these LEAs. 
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6. 1 Provision of Intercept Product - Circuit Switched 

Figure 12 shows the access method for the delivering of CC shall be bridged/ T-connection (see figure 12). 







3G MSC 




intercepted 
subscriber 






other 
party 











Y 

DeliveryFunction 3 
Figure 12: Bridged Access 



6.1.1 Delivery configuration to the LEMF 

Figure 13 shows the configuration for circuit switched calls. The signals of both parties of the configuration to be 
intercepted are delivered separately to the requesting function. The requesting function itself has no impact on the 
connection between the subscribers. 

The two stublines towards the LEMF. are established in parallel to the call set up. For both stublines the address is used 
which has been provided during activation. 

NOTE: For data calls it is necessary to provide means for fast call establishment towards the LEMF so that it 
doesn't miss the beginning of the data transmission. 



intercepted 
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3G MSC 



other 
party 



Delivery 
Function 3 



Two stublines 



-+> Two stublines 



LEMF 



Figure 13: Delivery configuration to the LEMF for the interception of a circuit switched call 
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6.1.2 X3-interface 

The following information needs to be transferred from the 3G MSC to the DF3 in order to allow the DF3 to perform its 
functionality: 

- target identity (MSISDN, IMSI or IMEI); note 1 

- signal indicator (direction indication; - Signal from target or signal to target); note 2 

- the target location (if available) or the IAs in case of location dependent interception, note 1 

- correlation information (IRI <-> CC); 
NOTE 1 : For DF3 internal use only. 

NOTE 2: e.g. integer, CC from target = 1 , CC from other party = 2. 
Additional information may be provided if required by national laws. 

6.2 Provision of CC - Short Message Service 

Figure 14 shows an SMS transfer from the 3G MSC to the LEMF. Quasi-parallel to the delivery from / to the mobile 
subscriber a message, which contains the contents of the SMS with the header, is generated and sent via the Delivery 
Function 2 to the LEMF in the same way as the Intercept Related Information. 

The IRI will be delivered to the LEMF: 

- for a SMS-MO. Dependent on national requirements, delivery shall occur either when the 3G MSC receives the 
SMS from the target MS, or when the 3G MSC receives notification that the SMS-Centre successfully received 
the SMS; 

- for a SMS-MT. Dependent on national requirements, delivery shall occur either when the 3G MSC receives the 
SMS from the SMSC, or when the 3G MSC receives notification that the target MS successfully received the 
SMS. 
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Figure 14: Provision of Content of Communication - Short Message Service 



6.3 Provision of Intercept Related Information 

Intercept Related Information (Events) are necessary at the Begin and End of the call, for all supplementary services 
during a call and for information which is not call associated. There are call related events and non call related events. 

Figure 1 5 shows the transfer of intercept related information to the DF2. If an event for / from a mobile subscriber 
occurs, the 3G MSC sends the relevant data to the DF2. 
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Figure 15: Provision of Intercept Related Information 

6.3.1 X2-interface 

The following information needs to be transferred from the 3G MSC to the DF2 in order to allow a DF2 to perform its 
functionality: 

- target identity (MSISDN, IMSI or IMEI); 

- in case of location dependent interception, the IAs and/or target cell ID shall be provided. 

- events and associated parameters as defined in subclauses 6.3.3 and 6.3.4 may be provided. 

6.3.2 Structure of the events 

The information sent to DF2 is triggered by up to eight different call related and non-call related events. Details are 
described m following subclause. The events for interception are configurable (if they are sent to DF2) in the 3G MSC 
and can be suppressed in the DF2. The events are listed as follows: 

Call Related Events: 

- Call Establishment 

- Answer 

- Supplementary Service 

- Handover 

- Release 

Non Call Related Events: 

- SMS 

- Location Update 

- Subscriber Controlled Input 

T ab ^ ™ W Sh ° WS ° f information mat is used t0 § enerate the events. The events transmit the information from 
the 3G MSC to DF2. This set of information can be extended in the 3G MSC, if this is necessary in a specific country 
DF2 can extend this information if this is necessary in a specific country e.g. a unique number for each surveillance 
warrant. 
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Table 1: Information Elements for Circuit Event records 



Observed MSISDN 

Target Identifier with the MSISDN of the target subscriber (m onitored subscriber) 

Observed IMSI ~ ^ 



Target Identifier with the IMSI of the target subscriber (monitored subscriber). 



Observed IMEI 

Target Identifier with the IMEI of the target subscriber (monitored subscriber), 
It shall be checked for each call over the radio interface 



event type 



Description which type of event is delivered: Establishment, Answer, Supplementary service 

Handover, Release, SMS, Location update, Subscriber controlled input 

event date " " 



Date of the event generation in the 3G MSC 



event time 

Time of the event generation in the 3G MSC 



dialled number 

Dialled phone number before digit modification, IN-modification etc. 

Connected number " """ ~~ 

Number of the answering party 

other party address ' — - 

Directory number of the other party for MOC 

Calling party for MTC 

call direction ~~ — - ~ 



Information if the monitored subscriber is calling or called e.g. MOC/MTC or originating/ terminating 



Correlation number — " ' — _ 

Unique number for each call sent to the DF, to help the LEA, to have a correlation between each 
Call and the IRI 

Location Information — " — 



Location information is the service area identity and/or location area identity that is present at the 3G MSC 
at the time of event record production 

basic service ~ ~~ ~ 

Information about Tele service or bearer s ervice. 

Supplementary service 



Supplementary services used by the target e.g. CF, CW, ECT 



Forwarded to number 
Forwarded to number at CF 



call release reason — 

Call release reason of the target call 

SMS Message * 

The SMS content with header which is sent with t he SMS-service 
Redirecting number 



The number which invokes the call forwarding towards the target. This is provided if available. 



SCI 

Non call related Subscriber Controlled Input (SCI) which the 3G MSC receives from the ME 
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6.3.3 Call Related events 



6.3.3.1 Call establishment 

For call establishment a call establishment-event is generated. This event is generated at the begining of a call when the 
3G MSC attempts to reach the subscriber. This information will be delivered to the DF2 if available: 

Observed MSISDN 
Observed IMS! 

Observed IMEI 

event type " 

event date 

event time 

dialled number " " 

other party address 

call direction 

Correlation number 

Redirecting number " 

Location Information 

basic service 

Supplementary service 



6.3.3.2 Answer 

If the called party answers, an answer- event is generated. This information will be delivered to the DF2 if available: 

Observed MSISDN 

Observed I MSI " 

Observed IMEI 

event type " " 

event date 

event time 

dialled number " ~~ 

other party address 

Connected party 

call direction 

Correlation number 

Redirecting number ~~ 

Location Information 

basic service 

Supplementary service 
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6.3.3.3 Supplementary Services 

For supplementary services events are generated with the information which supplementary service is used e g Call 
Forwarding (CF), Call Waiting (C W), Explicit Call Transfer (ECT), Multi Party (MPTY), Call Hold and information 
correlated to the service like the forwarded to number. This information will be delivered to the DF2 if available: 

Observed MSISDN 

Observed I MSI " 

Observed IMEI 

event type " 

event date 

event time " 
dialled number " 
other party address " 

call direction 

Correlation number — 

Location Information 

basic service " 
Supplementary service 

Forwarded to number " 



6.3.3.4 Handover 

For each handover that is realised at the 3G MSC due to a change in target location information, a handover-event with 
the new location information is generated. This information will be delivered to the DF2 if available: 

Observed MSISDN 

Observed I MSI 

Observed IMEI 

event type 

event date : " 

event time 

Correlation number " 
Location Information ~~ ~ " 



6.3.3.5 Release 

For the release or failed attempt of a target call, a release event with the following information is generated This 
information will be delivered to the DF2 if available: 

Observed MSISDN — 

Observed I MSI 

Observed IMEI 

event type " " 

event date __ 

event time " 
dialled number 

other party address " 

call direction 

Correlation number 

Location Information 

basic service 

call release reason — — _ - 
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6.3.4 Non Call Related events 



6.3.4.1 SMS 

For MO-SMS the event is generated in the 3G MSC. Dependent on national requirements, event generation shall occur 
either when the 3G MSC receives the SMS from the target MS or when the 3G MSC receives notification that the 
SMSC successfully received the SMS; for MT-SMS the event is generated in the 3G MSC. Dependent on national 
requirements, event generation shall occur either when the 3G MSC receives the SMS from the SMSC or when the 
3G MSC receives notification that the target MS successfully received the message. This information will be delivered 
to the DF2 if available: 



Observed MSISDN 
Observed I MSI 

event type 

event date 

event time 

Location Information 
SMS Message 



6.3.4.2 Location update 

For location updates a Location update-event is generated, with the new location (location area) information This 
information will be delivered to the DF2 if available: 



Observed MSISDN 
observed IMSI 

event type 

event date 

event time 

Location Information 



6.3.4.3 Subscriber Controlled Input (SCI) 

SCI includes subscriber initiated changes in service activation and deactivation. SCI does not include any information 
available m the CC. For subscriber controlled inputs - a SCI-event is generated with information about the SCI This 
information will be delivered to the DF2 if available: 



observed MSISDN 
observed IMSI 

event type 

event date 

event time 

Location Information 
SCI 
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6.4 Intercept cases for circuit switched supplementary services 
6.4. 1 Interception of Multiparty call 



3G MSC 



B 
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DF3 



Figure 16: Interception of Multiparty for CC 

Figure 1 6 shows the delivery of CC from intercepted multiparty call where party A is the target of interception. 

One pair of call content channels are delivered to the delivery function. Party A is delivered to the DF3 on one channel 
and the sum of the balance of the parties, B,C and D is delivered on the second channel. 

It should be noted that if parties B,C or D is a target of interception, that intercept is treated as a simple call intercept. 

The events contain information about B, C and D if subscriber A is monitored. If one of B, C or D is monitored events 
contain the information about A but not the other parties of the conference. 



6.4.2 Interception for Call Forwarding / Call Deflection / ECT 
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For Intercept Related Information it depends who is monitored: 

- If subscriber A is monitored the number of A and B are mandatory in the event information and the number of C 
if available. 

- If subscriber B is monitored the number of B and C are mandatory in the event information and the number of A 
if available. 

- If subscriber C is monitored the number of C is mandatory in the event information and the number of A and B if 
available. 



7 Invocation of Lawful Interception for Packet Data 
services 

Figure shows the extract from the reference configuration which is relevant for the invocation of the Lawful 
Interception. 
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Figure 18: Functional model for Packet Data Lawful Interception invocation 

The HI2 and HI 3 interfaces represent the interfaces between the LEA and two delivery functions Both interfaces are 
subject to national requirements. They are included for completeness, but are beyond the scope of this specification 
The delivery functions are used: 

- to convert the information on the X2r>interface to the corresponding information on the HI2 interface; 

- to distribute the intercept related information to the relevant LEA(s); 

- to distribute the intercept product to the relevant LEA(s). 

In case a Packet Data communication is selected based on several identities (MSISDN, IMSI, IMEI ) of the same 
target, the 3G SGSN and/or, per national option 3G GGSN will deliver CC and IRI only once to the DF2P and DF3P 
DF2P and DF3P will then distribute the information to the relevant LEAs. 

For the delivery of the CC and IRI the 3G SGSN and/or, per national option 3G GGSN provides correlation number 
and target identity to the DF2P and DF3P which is used there in order to select the different LEAs where the product 
shall be delivered. 

The correlation number is unique in the whole PLMN and is used to correlate CC with IRI and the different IRTs of one 
PDP context. 

The correlation number shall be generated by using existing parameters related to the PDP context. 

NOTE: If interception has been activated for both parties of the Packet Data communication both CC and IRI will 
be delivered for each party as separate intercept activity. 
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In case of location dependent interception: 

- for each target, the location dependency check occurs at each Packet Data session establishment or release and at 
each cell and/or Routing Area (RA) update to determine permanently the relevant IAs (and deduce the possible 
LEAs within these IAs), 

- concerning the IRI: 

- when an IA is left, a Mobile Station Detach event is sent when changing servicing 3 G G SNs or a cell and/or 
RA update event is sent when changing IAs inside the same servicing 3G SGSN to DF2P; 

- when a new IA is entered a cell and/or RA update event is sent to DF2P and, optionally, a Start of 
Interception with Active PDP Context event for each PDP context; 

- concerning the CC, when crossing IAs, the CC is not sent anymore to the DF3P of the old IA but sent to the 
DF3P of the new IA. 

Both in case of location dependent and location independent interception: 

"Start of interception with active PDP context" event is sent by the new SGSN if an Inter-SGSN RA update procedure 
which involves different PLMNs, takes place for a target, which has at least one active PDP context. 

NOTE: An SGSN can differentiate "Inter PLMN" type of Inter-SGSN RA update procedure from "Intra PLMN" 
type of Inter-SGSN RA update procedure by inspecting the old RAI parameter, which is being received 
by the SGSN as part of the procedure (see 3GPP TS 23.060, section 6.9. 1 .2.2 and 3GPP TS 23 003 
section 4.2). 

7. 1 Provision of Intercept Product - Short Message Service 

Figure 19 shows an SMS transfer from the 3G SGSN node to the LEA. Quasi-parallel to the delivery from / to the 
mobile subscriber a message, which contains the content and header of the SMS, is generated and sent via the Delivery 
Function 2P to the LEA in the same way as the Intercept Related Information. 

The IRI will be delivered to the LEA: 

- for a SMS-MO. Dependent on national requirements, delivery shall occur either when the 3G SGSN receives the 
SMS from the target MS or when the 3G SGSN receives notification that the SMS-Centre successfully received 
the SMS; 

- for a SMS-MT. Dependent on national requirements, delivery shall occur either when the 3G SGSN receives 
the SMS from the SMS-Centre or when the 3G SGSN receives notification that the target MS successfully 
received the SMS. 
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Figure 19: Provision of Intercept Product - Short Message Service 
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7.2 Provision of Intercepted Content of Communications - 
Packet data services 

The access method for the delivering of Packet Data Intercept Product is based on duplication of packets without 
modification at 3G GSN. The duplicated packets with additional information in the header, as described in the 
following sections, are sent to DF3P for further delivery via a tunnel. 
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Figure 20: Configuration for interception of Packet Data product data 

7.2.1 X3p-interface 

In addition to the intercepted call content, the following information needs to be transferred from the 3G GSN to the 
DF3P in order to allow the DF3P to perform its functionality: 

- target identity; 

- correlation number, 

- the target location (if available) or the IAs in case of location dependent interception. 
Additional information may be provided as a national option. 

7.3 Provision of Intercept Related Information 

Intercept Related Information (Events) are necessary at the Mobile Station Attach, Mobile Station Detach PDP Context 
Activation, Start of intercept with PDP context active, PDP Context Deactivation, Cell and/or RA update 'and SMS 
events. 



Figure 2 1 shows the transfer of intercept related information to the DF2P. If an event for / from a mobile subscriber 
occurs, the 3G GSN sends the relevant data to the DF2P. 
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Figure 21: Provision of Intercept Related Information 

7.3.1 X2p-interface 

The following information needs to be transferred from the 3G GSN to the DF2P in order to allow a DF2P to perform 
its functionality: 

- target identity (MSISDN, IMSI, IMEI); 

- events and associated parameters as defined in section 7.3.2 and 7.4 may be provided; 

- the target location (if available) or the I As in case of location dependent interception; 

- Correlation number. 

7.3.2 Structure of the events 

There are seven different events in which the information is sent to the DF2P if this is required. Details are described in 
the following section. The events for interception are configurable (if they are sent to DF2P) in the 3G GSN and can be 
suppressed in the DF2P. 

The following events are applicable to 3G SGSN: 

- Mobile Station Attach; 

- Mobile Station Detach; 

- PDP context activation; 

- Start of intercept with PDP context active; 

- PDP context deactivation; 

- RA update; 

- SMS. 

NOTE: 3G GGSN interception is a national option. Location information may not be available in this case. 
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The following events are applicable to the 3G GGSN: 

- PDP context activation; 

- PDP context deactivation; 

- Start of interception with PDP context active. 

A set of fields as shown below is used to generate the events. The events transmit the information from 3G GSN to 
DF2P. This set of fields as shown below can be extended in the 3G GSN, if this is necessary as a national option DF2P 
can extend this information if this is necessary as a national option e.g. a unique number for each surveillance warrant. 

Table 2: Information Events for Packet Data Event Records 

Observed MSISDN " " ' ~ 

MSISDN of the target subscriber (monitored subscriber) 

Observed I MSI " ~ 

IMSI of the target subscriber (monitored subscriber) 

Observed IMEI ' ~ ■ 

IMEI of the target subscriber (monitored subscriber), it shall be checked for each activation ov er the radio interface 

Event type ~ '■ 

Description which type of event is delivered: PDP attach, PDP detach, PDP context activation Start of intercept with 

PDP context active, PDP context deactivation, SMS, Cell and/or RA update, 

Event date ~~ ~ 1 

Date of the event generation in the 3G GSN 

Event time " ™ — 

Time of the event generation in the 3G GSN 

PDP address ~ " " ~~ 

The PDP address of the target subscriber. Note that this address might be dynamic. 

Access Point Name ~ " 

The APN of the access point. (Typically the GGSN of the other party) 

Routing Area Code ~ " 

The routing area code of the target defines the RA in a PLMN. 

PDP Type " ~ 

The used PDP type. 

Correlation Number " " " 

The correlation number is used to correlate CC and IRi. 

"SMS ~ " — 

The SMS content with header which is sent with the SMS-service. The header also includes the SMS-Centre 
address. 

SAi ' ' 

Service Area Identity 

Failed attach reason " ~ " " ~ 

Reason for failed attach of the target subscriber. 

Failed context activation reason " " " " 

Reason for failed context activation of the target subsc riber 

lAs L ■ ■ 

The observed Interception Areas 
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7.4 Packet Data related events 



7.4. 1 Mobile Station Attach 

For attach an attach-event is generated. When an attach activation is generated from the mobile to servicing 3G G SN 
this event is generated. These fields will be delivered to the DF2P if available: 

Observed MSiSDN 
Observed I MSI 

Observed IMEl 

Event Type 

Event Time 

Event Date 
Service Area identity 

Routing area code 

Failed attach reason 

lAs (if applicable) 



7.4.2 Mobile Station Detach 

For detach a detach-event is generated, this is for the common (end) detach. These fields will be delivered to the DF2P 
if available: 

Observed MSISDN 

Observed I MSI 

Observed IMEl 
Event Type 

Event Time 

Event Date 
Service Area Identity 

Routing Area code 

lAs (if applicable) 



7.4.3 Packet Data PDP context activation 

For primary PDP context activation and for secondary PDP context activation a PDP context activation-event is 
generated. When a PDP context activation is generated from the mobile to 3G GSN this event is generated These fields 
will be delivered to the DF2P if available: 

Observed MSISDN 
Observed I MSI 
Observed IMEl 

PDP address of observed party 

Event Type 

Event Time 

Event Date 
Correlation number 

Access Point Name 

PDP Type 

Service Area Identity 

Routing area code 

Failed context activation reason 

lAs (rf applicable) 

NOTE: Each primary and secondary PDP context uses a unique Correlation number. 
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7.4.4 Start of interception with PDP context active 

This event will be generated if interception for a target is started and if the target has at least one PDP context active. If 
more then one PDP context are open for each of them an event record is generated. These fields will be delivered to the 
DF2P if available: 

Observed MSISDN 
Observed IMS! 
Observed IMEI 

PDP address of observed party 

Event Type 

Event Time 

Event Date 
Correlation number 
Access Point Name 
PDP Type 

Service Area Identity 

Routing area code 

lAs (if applicable) 



7.4.5 Packet Data PDP context deactivation 

At deactivation of a primary PDP context and at deactivation of a secondary PDP context a PDP context deactivation- 
event is generated. These fields will be delivered to the DF2 if available: 

Observed MSISDN 
Observed I MSI 
Observed IMEI 

PDP address of observed party 

Event Type 

Event Time 

Event Date ~ 
Correlation number 

Access point name 

Service Area Identity 

Routing area code 

lAs (if applicable) 



7.4.6 RA update 

For each RA update an update-event with the fields about the new location is generated. These fields will be delivered 
to the DF2P if available: 



Observed MSISDN 
Observed I MSI 
Observed IMEI 

Event Type 

Event Time 

Event Date 

Service Area Identity 
Routing area code 
lAs (if applicable) 



7.4.7 SMS 

For MO-SMS the event is generated in the 3G SGSN. Dependent on national requirements, event generation shall occi 
either when the 3G SGSN receives the SMS from the target MS or when the 3G SGSN receives notification that the 
SMS-Centre successfully received the SMS; for MT-SMS the event is generated in the 3G SGSN. Dependent on 
national requirements, event generation shall occur either when the 3G SGSN receives the SMS from the SMS-Centre 
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or when the 3G SGSN receives notification that the target MS successfully received the message These fields will be 
delivered to the DF2P if available: 

Observed MSISDN 

Observed I MSI 

Observed IMEI 

Event Type • 

Event Time 

Event Date _^ 

Service Area Identity 

Routing area code 

SMS 

lAs (if applicable) 



7.5 Intercept cases for supplementary services 

Supplementary services may be used with Packet Data. However they are not standardised and therefore Lawful 
Interception interwork cases can not be defined at the time of publication of this document. 



8 Security 

The security requirements are valid for the whole Lawful Interception system, i.e. rules and procedures shall be used for 
all involved entities, 3G GSN and the DF. 



8.1 Administration security 

The administration of the LI function, i.e. Activation, Deactivation and Interrogation of Lawful Interception, in the 3G 
GSN, 3G MSC and the DFs shall be done securely as described below: 

- It shall be possible to configure the authorised user access within the serving network to Activate, Deactivate and 
Interrogate Lawful Interception separately for every physical or logical port at the 3G MSC and DF. It shall be 
possible to passwork protect user access. 

- Only the ADMF is allowed to have access to the LI functionality in the 3G MSC, 3G GSN and DF. 

- The communication links between ADMF, 3G GSN,3G MSC, DF2, DF2P, and DF3, DF3P may be required by 
national option to support secutiry mechanisms. Options for security mechansisms include: 

CUG/VPN; 

- COLP; 

- authentication; 

- encryption. 

Through the use of user access restrictions, no unautorized network entities or remote equipment shall be able to view 
or manipulate LI data in the 3G GSN, 3G MSC or the DFs. 
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8.2 IRI security 

8.2.1 Normal operation 

The transmission of the IRI shall be done in a secure manner. 

When DFs are physically separate from the 3G MSC and 3G GSN, the X2 and X2r>interfaces may be required by 
national option to support security mechanisms. Options for security mechansisms include: 

- CUG/VPN; 

- COLP; 

- authentication; 

- encryption. 

8.2.2 Communication failure 

Depending on the national law in case of communication failure IRI may be buffered in the 3G MSC and 3G GSN 
After successful transmission of IRI the whole buffer shall be deleted. It shall be possible to delete the content buffer 
via command or a timer, in an unrestoreable fashion. 

8.3 CC security 

The transmission of the CC shall be done in a secure manner. 

When DFs are physically separate from the 3G MSC and 3G GSN, the X3 and X3p-interfaces may be required by 
national option to support security mechanisms. Options for security mechansisms include: 

- CUG/VPN; 

- COLP; 

- authentication; 

- encryption. 

In case of transmission failure no buffering is required within the intercepting network. 

8.4 Security aspects of Lawful Interception billing 

Billing information may be suppressed or made available at the DFs and the ADMF. Billing information for Lawful 
Interception shall be separated from "regular" billing data. 

Billing data transmission to the Lawful Interception billing system may be done in a secure manner per national option. 

In case of transmission failure billing-data shall be buffered/stored in a secure way. After successful transmission billim 
data shall be deleted in an unrestorable fashion. 4 

8.5 Other security issues 
8.5.1 Log files 

Log files shall be generated by the ADMF, DF2, DF2P, DF3, DF3P, 3G MSC and the 3G GSN. All log files are 
retrievable by the ADMF, and are maintained by the ADMF in a secure manner. 
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8.5.2 Data consistency 

The administration function in the PLMN shall be capable to perform a periodic consistency check to ensure that the 
target list of MSISDN, IMSI or IMEI is the same in all involved 3G MSCs and 3G GSNs in the PLMN and the DFs 
The reference data base is the ADMF data base. 
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Annex A (informative): 

Information flows for Lawful Interception invocation of circuit 
switched services 

The following figures show the information flows for the invocation of Lawful Interception for various types of calls. 
The figures show some of the basic signalling messages of the target calls and the events on the X2 and X3-interfaces. 
The ISUP messages to and from the network are shown for informational purposes only; some of them may not be sent 
or may be combined in certain networks. 



A.1 Mobile originated circuit switched calls 

Figure A.l shows the interception of a basic mobile originated circuit switched speech or data call where the originating 
mobile (A) is the target for interception. B is not necessarily also a mobile subscriber and resides on a different 
exchange. 
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Figure A.1: Interception of mobile originated circuit switched calls 

In figure A.l the result (answer) of the set-up of the stublines is not shown. This assumes no special action is taken ij 
case of failure. 
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A.2 Mobile terminated circuit switched calls 

Figure A.2 shows the interception of a basic mobile terminated circuit switched speech or data call where the 
terminating mobile (B) is the target for interception. A is not necessarily also a mobile subscriber and resides 
different exchange. 
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Figure A.2: Interception of mobile terminated circuit switched calls 
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A.3 Call hold / call waiting 

Figures A.3 and A.4 show the interception of calls involving call hold / call waiting. Figure A.3 covers the case where 
one stubline or one pair of stublines is used per target, figure A4 covers the case where a separate stubline or pair of 
stublines is used for each target call. The mobile that receives the waiting call (A) is the target for interception 
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Figure A.3: Interception of call hold / call waiting - stublines per target 
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Figure A.4: Interception of call hold / call waiting - stublines per target call 



A.4 Multiparty calls 

Figures A.5 and A.6 show the interception of multiparty calls. Figure A.5 covers the case where one stubline or one pair 
of stublines is used per target, figure A.6 covers the case where a separate stubline or pair of stublines is used for each 
target call. The mobile setting up the multiparty call (A) is the target for interception. 
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Figure A.5: Interception of multiparty calls - stublines per target 



3GPP 



Release 1999 



39 



3GPP TS 33.107 V3.5.0 (2002-03) 



DF2 



DF3 



Stublines cor tain CC of AB 



stubtines " cor tain CCofAC 



stublines ' cont lin CC of AB C 
stublines" cont 3in CC of ABC 



stublines" con y ain CC of AC 



stublines ' con tain CC of AB 



MS A 3G MSC 

SETUP(AB) 



Sjjppl. Service(AB, CHOLp) 
SETUP(AC) 



HOLD(AB) 



as in figure A1 
Answer(AB) 



HOLD ACK(AB) 



Answer(AC) 



BuildMPTY(AB) 



.. setup and interc option of AC call as 



BuildMPTY ACK(AB) 



S|jppl. Service(AB, BMPTY) 

ro 



Si ippl. Service(AC, BMPT 



SplitMPTY(AC) 



SplitMPTY ACK(AB) 



Sjppl. Service(AC,SMPTO 



S jpp». Service(AB, HMPTK) 



DISCONNECT(AC) 



Release(AC) 



RetrieveMPTY ACK(AB) 
^ 



Si ippl. Service(AB, RMPT f) 



RetrieveMPTY(AB) 



/ release of AC cfeii and interception 



DJSCONNECT(AB) 



Release(AB) 



REL 



, r » <-\ . 

release of AB call and interception 



REL 



Figure A.6: Interception of multiparty calls - stublines per target call 
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A.5 Call forwarding / call deflection 

The following pictures show the information flows for the interception of forwarded calls. Information flows will be 
given for three typical cases of call forwarding. All other types of call forwarding / call deflection are intercepted 
similar to one of these. 



A.5. 1 Unconditional call forwarding 

Figure A.7 shows the interception of unconditionally forwarded calls. The mobile that activated unconditional call 
forwarding (B) is the target for interception. In this case interception will be performed at the 3G GMSC, where the 
Service Request Indicator (SRI) request for B is issued and subsequently the SRI response indicating that the call shall 
be forwarded is received. 
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Figure A.7: Interception of unconditional call forwarding 



A.5.2 Call forwarding on not reachable (IMSI detached) 

Call forwarding on not reachable because the IMSI is detached is also handled on the 3G GMSC. Interception of this 
type of call forwarding is similar to interception of unconditional call forwarding. 
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A.5.3 Call forwarding on busy (network determined) 

Figure A.8 shows the interception of call forwarding on busy (network determined). The mobile that activated call 
forwarding on busy (B) is the target for interception. In this case interception will be performed at the 3G MSC where B 
resides, where the busy condition is detected and the call is forwarded. 
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Figure A.8: Interception of call forwarding on busy (network determined) 



A.5.4 Call forwarding on not reachable (no response to 
paging/radio channel failure) 

Call forwarding on not reachable because of no response to paging or radio channel failure is also handled on the 3G 
MSC similar to call forwarding on busy (network determined). Interception of this type of call forwarding is therefore 
done in the same way. (see section A.5.3) 
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A.5.5 Call forwarding on no reply 

Figure A9 shows the interception of call forwarding on no reply. The mobile that activated call forwarding on no reply 
(B) is the target for interception. In this case interception will be performed at the 3G MSC where B resides, where the 
no reply condition is detected and the call is forwarded. Initially, the interception is similar to the interception of a basic 
mobile terminated circuit switched speech of data call. On no reply time-out, the interception will continue on the 
forwarded call to C. 
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Figure A.9: Interception of call forwarding on no reply 

In figure A.9 the release of the stublines is done after the forwarded call is released by A or C. It is a national option not 
to support interception of forwarded calls. In that case, the release of the stublines is done after the call is forwarded and 
B is no longer involved. 



A.5.6 Call forwarding on busy (user determined)/call deflection 

Call forwarding on busy (user determined) and call deflection are also handled on the 3G MSC similar to call 
forwarding on no reply. Interception of this type of call forwarding is therefore done in the same way. (see A5.5) 
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A.5.7 Call waiting / call forwarding on no reply 

Figures A. 1 0 and A. 1 1 show the interception of a call involving both call waiting and call forwarding on no reply 
Figure A.10 covers the case where one stubline or one pair of stublines is used per target, figure Al 1 covers the case 
where a separate stubline or pair of stublines is used for each target call. The mobile that activated call forwarding on n 
reply and receives the waiting call (B) is the target for interception. In figure A. 1 0 a new (pair of) stublines needs to be 
set up when the call is forwarded since the first (pair of) stublines is still used for the initial call. 
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Figure A.10: Interception of call waiting / call forwarding on no reply - stublines per target 
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Figure A.1 1 : Interception of call waiting / call forwarding on no reply - stublines per target call 
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A.6 Explicit call transfer 

Figures A. 1 2 and A. 1 3 show the interception of explicit call transfer. Figure A. 12 covers the case where one pair of 
stublines is used per target, figure A. 1 3 covers the case where a separate pair of stublines is used for each target call 
The mobile transferring the call (B) is the target for interception. 
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Figure A.12: Interception of explicit call transfer - stublines per target 
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Figure A.13: Interception of explicit call transfer - stublines per target call 

In figures A. 1 2 and A. 1 3 the release of the stublines is done after the transferred call is released by A or C It is a 
national option not to support interception of transferred calls. In that case, the release of the stublines is done after the 
call is transferred and B is no longer involved. 
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Annex B (informative): 

Information flows for Lawful Interception invocation of 
Packet Data services 

The following figures show the ^formation flows for the invocation of Lawful Interception for Packet Data and typical 
scenarios. The figures show some of the basic signalling messages of the target Packet Data communication and the 
events on the X2P and X3P interfaces. The dotted lines indicate signalling depending on whether CC and/or IRI 
information has been requested. The Gateway 3G GGSN may setup/release packet tunnels and send IRI information 
depending on national requirements. 

The use of the Gateway 3G GGSN for interception is a national option. 

EM Mobile Station Attach 

Figure B. 1 shows the interception of a basic Mobile Station Attach where the mobile (A) is the target for 
interception. L 
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Figure B.1: Interception of mobile originated Mobile Station Attachment 
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B.2 Mobile Initiated Mobile Station Detach 

Figure B.2 shows the interception of a Mobile Initiated Mobile Station Detach where the originating mobile 
target for interception. ~ 



DF3P MS A 3G SGSN 









Detach Request 
































- ; Sec 


i.r i ^ , j 1 1 1 1 1 a i v v. ri 

g.8 whenxontext is, deactivated; 














'.'■'.VS.: 
















•+ - 






Detach Accept 
Mobile Station Detach 













Figure B.2: Interception of mobile originated Mobile Station Detachment 
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B.3 Network initiated Mobile Station Detach 

Figure B.3 shows the interception of a network initiated (by 3G SGSN or HLR) Mobile Station Detach where the 
mobile (A) is the target for interception. 
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Figure B.3: Interception of network initiated Mobile Station Detach 



B.4 Intra 3G GSN Routing Area Update 

Figure B.4 shows the interception of an Intra Routing Area Update where the mobile (A) is the target for interception 
The sequence is the same for the combined RA / LA Update procedure but additional signalling is performed between 
the current 3G SGSN and the prior 3G SGSN before the Routing Area Update Accept message is sent to the MS. 
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Figure B.4: Interception of an Intra Routing Area Update 
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B.5 Inter 3G GSN Routing Area Update 

Figure B.5 shows the interception of an Inter Routing Area Update where the mobile (A) is the target for interception 
The sequence is the same for the combined RA / LA Update procedure but additional signalling is performed between 
the 3G.GSN, HLR and the old 3G GSN before the Routing Area Update Accept message is sent to the MS. In case of 
PDP context not being active less signalling is required. 
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Figure B.5: Interception of an Inter Routing Area Update 
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B.6 PDP Context Activation 



Figure B.6 shows the interception of a PDP Context activation where the mobile (A) is the target for interception The 
sequence for a network initiated PDP Context activation is analogous but is preceded by the 3G GSN sending a Reauest 
PDP Context Activation to the MS. 
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Figure B.6: Interception of a PDP Context Activation 



B.7 Start of interception with PDP context active 

A tunnel is established to DF3P and an event is sent to DF2P. 
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B.8 MS initiated PDP Context Deactivation 

Figure B.7 shows the interception of a MS initiated PDP Context deactivation where the mobile (A) is the target for 
interception. 
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Figure B.7: Interception of a PDP Context Deactivation 



B.9 Network initiated PDP Context Deactivation 

Figure B.8 shows the interception of a Network initiated PDP Context deactivation where the mobile (A) is the target 
for interception. The 3G GGSN may send, (depending on national requirements) the PDP Context deactivation and 
release the Packet Data tunnel after the Delete PDP Context Response has been sent or received, (signalling between the 
3G SGSN and the 3G GGSN is not shown here). 
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Figure B.8: Interception of a Network initiated PDP Context Deactivation 
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B.10 SMS 

Figure B.9a and B.9b show the interception of a Mobile-terminated SMS. Figure B.lOa and .BlOb show the interception 
of a Mobile-originated SMS. In all the scenarios, the mobile <aih«-rihpr f a\ 
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Figure B.9a: MT-SMS interception after 3G SGSN receives notification of SMS delivery to MS(A) 
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Figure B.9b: MT^SMS interception after 3G SGSN receives SMS from SMSC 
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Figure B.10a: MO-SMS interception after 3G SGSN receives notification of SMS delivery from SMSC 
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Figure B.10b: MO-SMS interception after 3G SGSN receives SMS from MS(A) 
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